Privacy Reports

INVESTIGATION REPORT

 

 

 

INVESTIGATION I95-030P

 

 

A COLLEGE OF APPLIED ARTS AND TECHNOLOGY

 

 

 

 

 

December 6, 1995

INTRODUCTION

 

 

Background of the Complaint

 

This investigation was initiated as a result of a complaint concerning a college of applied arts and technology (the College). 

 

The complainant was a former nursing student at the College.  Around February 1991, some faculty members and students heard the complainant threatening to kill himself and anyone who tried to stop him from becoming a nurse. These threats were brought to the attention of a College Vice President in December 1991 who then met with the complainant in January 1992 to discuss the matter.  Following this meeting, the complainant sent a letter to the College apologizing for his behaviour.  However, later on in October 1992, he wrote to a nursing instructor complaining about being harassed and discriminated against.  In his letter, he stated that he would not allow anyone to tell him that he was not suitable for nursing.  A month later, the complainant left the College.

 

Between January 1992 and June 1993, the complainant initiated a series of proceedings against the College and individual staff members, including complaints to the Ontario Human Rights Commission, complaints to the Ontario College of Nurses, and a civil action against the College.

 

The complainant was also a patient at a psychiatric institute (the Institute).  On May 2, 1995 while reviewing his file at the Institute, the complainant found a letter in his file dated June 2, 1993 from a Dean of the College to a psychiatrist at the Institute requesting a "risk assessment" concerning the complainant which included the statement:

 

I would appreciate your professional opinion on this individual's potential of risk for physical violence.

 

Enclosed with the request, was a copy of the October 15, 1992 letter that the complainant had written to the nursing instructor.

 

The complainant believed that the actions of the College in obtaining the risk assessment breached the Freedom of Information and Protection of Privacy Act (the Act).

 

 

Issues Arising from the Investigation

 

The following issues were identified as arising from the investigation:

 

(A)       Did the College’s letter to the Institute which included the complainant’s letter, and the risk assessment contain "personal information", as defined in section 2(1) of the Act?  If yes,

 

(B)       Did the College collect the complainant's personal information in compliance with section 38(2) of the Act?

 

(C)       Did the College provide proper notice of collection of the complainant's personal information, in compliance with section 39(2) of the Act?    

 

(D)       Did the College disclose the complainant's personal information contained in his letter to the nursing instructor, in compliance with section 42 of the Act?

 

 

 

RESULTS OF THE INVESTIGATION

 

Issue A:          Did the College’s letter to the Institute which included the complainant’s letter, and the risk assessment contain the complainant's "personal information", as defined in section 2(1) of the Act?

 

 

Section 2(1) of the Act defines "personal information" as recorded information about an identifiable individual, including,

...

 

(b)        information relating to the education or the medical, psychiatric, psychological, criminal or employment history of the individual or information relating to financial transactions in which the individual has been involved,

...

 

(e)        the personal opinions or views of the individual except if they relate to another individual,

...

 

(g)        the views or opinions of another individual about the individual, and

 

(h)        the individual's name if it appears with other personal information relating to the individual or where the disclosure of the name would reveal other personal information about the individual;

 

The College’s letter dated June 2, 1993 to the Institute included the complainant’s October 15, 1992 letter to the College. The complainant’s letter included his name, information about his educational history at the College, and his views about various matters relating to his studies at the College.  It is, therefore, our view that the College’s letter together with the complainant’s

 

letter contained information which met the requirements of paragraphs (b), (e), (g) and (h) of the definition of personal information in section 2(1) of the Act. 

 

It is also our view that the risk assessment which contained a professional opinion about the complainant’s risk potential was information which met the requirements of paragraph (g) of the definition of personal information in section 2(1) of the Act. 

Conclusion:    The College’s letter to the Institute which included the complainant’s letter, and the risk assessment contained the complainant's personal information, as defined in section 2(1) of the Act.

 

 

Issue B:           Did the College collect the complainant's personal information in compliance with section 38(2) of the Act?

 

The College initially advised us that they had requested the risk assessment because, even after the complainant had left the College, nursing faculty staff were still very apprehensive about the complainant. They were concerned that he might return to the College.  The College also stated that in addition, the complainant had filed several complaints with the Ontario Human Rights Commission, the Ontario College of Nurses, and the Ombudsman, and had also initiated a civil suit against the College.  According to the College, staff had expressed their concerns about the escalating nature of his various complaints.  The College indicated that the purpose for requesting a risk assessment was to allay these concerns.

 

However, in response to our draft report, the College added that the purpose of obtaining the risk assessment was to enable the College to “discharge its duties with regards to the safety at work and within the learning environment” and to “assist (its) legal counsel in advising on appropriate legal course of action given the ongoing, and escalating litigation commenced by (the complainant).”

 

Section 38(2) of the Act sets out the circumstances under which an institution under the Act can collect personal information.  This section states:

 

No person shall collect personal information on behalf of an institution unless the collection is expressly authorized by statute, used for the purposes of law enforcement or necessary to the proper administration of a lawfully authorized activity.

 

The College indicated that it had relied on all three conditions of section 38(2) of the Act for its collection of the complainant's personal information as follows: 

 

(a) Expressly authorized by statute

 

The College was of the view that its collection was expressly authorized by the Occupational Health and Safety Act (OHSA).  The College cited section 25(2)(d) of the OHSA which provides that the employer shall:

 

acquaint a worker or a person in authority over a worker with any hazard in the work and in the handling, storage, use, disposal and transport of any article, device, equipment or a biological, chemical or physical agent;

 

The College also cited sections 25(2)(h), 27(2)(a), 27(2)(c) and 32(a) of the OHSA.  Section 25(2)(h) of the OHSA requires that the employer:

take every precaution reasonable in the circumstances for the protection of a worker;

 

Section 27(2)(a) requires that a supervisor:

 

advise a worker of the existence of any potential or actual danger to the health or safety of the worker of which the supervisor is aware;

 

Section 27(2)(c) of the OHSA requires that a supervisor:

 

take every precaution reasonable in the circumstances for the protection of a worker.

 

Section 32(a) states:

 

Every director and every officer of a corporation shall take all reasonable care to ensure that the corporation complies with

 

(a)        this Act and the regulations;

 

The College believed that the threats by the complainant could reasonably be perceived as a hazard to its employees.  The College stated it had thus taken a "reasonable step" by asking for a risk assessment of the complainant.

 

We accept that the College's concerns about the complainant may have been valid and that the sections of the OHSA cited above set out the obligations of the College, as an employer to take reasonable steps to ensure the health and safety of its employees.   However, the phrase “expressly authorized by statute” in section 38(2) of the Act requires either that specific types of personal information collected be expressly described in the statute, or a general reference to the activity be set out in the statute, together with a specific reference to the personal information to be collected in a regulation under the statute; i.e., in a form or in the text of the regulation.  It is our view that the neither the OHSA nor its regulations specifically provided for the College's collection of the complainant's personal information.  Therefore, the College's collection of the complainant's personal information was not "expressly authorized by statute" within the meaning of section 38(2) of the Act.

 

 

b) Used for the purposes of law enforcement

 

"law enforcement" is defined in section 2(1) of the Act as:

 

(a)        policing,

 

(b)        investigations or inspections that lead or could lead to proceedings in a court or tribunal if a penalty or sanction could be imposed in those proceedings, and

 

(c)        the conduct of proceedings referred to in clause (b);

 

The College stated that its action of requesting an expert opinion in respect of the perceived risk imposed by the complainant constituted an action of "law enforcement" as defined under the Act. The College further stated that it was its view that "the investigation of an individual who had uttered death threats" could have led to proceedings in a court or tribunal in which a penalty or sanction could be imposed.  On this basis, the College believed that the collection of the risk assessment was for the "purposes of law enforcement" and was, therefore, authorized.

 

In our view, the College’s actions as an employer in this case, including obtaining the risk assessment, were not activities that would be considered to be either policing or law enforcement inspections or investigations as defined in section 2(1) of the Act.  In our view, a law enforcement investigation is one which is more appropriately undertaken by such traditional law enforcement agencies as a police services board or by an institution which has the function of enforcing or regulating compliance with a specific statute or regulation and that the “penalty or sanction” referred to would be one that could be imposed as a result of a violation of the law or regulation.

 

Accordingly, it is our view that obtaining a psychiatric risk assessment of an individual would not constitute a law enforcement investigation in the requisite sense and that the risk assessment itself would not be classified as having to do with law enforcement. We are, therefore, not persuaded that the College's collection of the complainant’s personal information was “used for the purposes of law enforcement”, in compliance with section 38(2) of the Act.

 

   

(c) Necessary to the proper administration of a lawfully authorized activity

 

In our draft report, we stated that the College had submitted that its provision of educational services to its students and the employment of faculty and support staff for this purpose clearly constituted a "lawfully authorized activity".  We also stated that the College had further submitted that it had an obligation to protect the safety of its staff and students; that this obligation was established by the OHSA, the common law of negligence, and was enshrined in two different College policies:  "Emergency Policies" and "Policies Regarding Persons Posing a Risk of Harm". 

In our draft report, we acknowledged that the protection of the safety of staff and students from harm was a lawfully authorized activity.  However, we indicated that under section 38(2) of the Act, the College was required to demonstrate that its collection of the risk assessment was "necessary" to the proper administration of a lawfully authorized activity and that in our view, the College had not demonstrated that it was necessary to obtain the risk assessment to ensure the safety of its staff.

 

However, in response to our draft report, the College stated that “it was evident that the dominant purpose for the risk assessment” was to permit the College’s legal counsel “to advise with respect to choices and alternatives in then current and contemplated future litigation involving (the complainant) and his activities.”

 

We asked the College to provide us with a detailed explanation as to how obtaining the risk assessment was or would be specifically necessary to deal with existing and future litigation.  The College referred us to two documents which had been submitted previously and reiterated that the risk assessment was necessary in order for legal counsel to properly advise the College as to how it should proceed in the context of existing and contemplated litigation. 

 

We have carefully reviewed the College’s representations.  In our view, the College has not provided us with a satisfactory explanation as to how obtaining the personal information contained in the risk assessment was necessary in order for the College to deal with the existing litigation initiated by the complainant, i.e., his complaints to the Ontario Human Rights Commission, the Ontario College of Nurses and the Ombudsman, and his civil action against the College.

 

We are also of the view that the College has not adequately demonstrated how obtaining the risk assessment was necessary to any contemplated future litigation.  For example, the College stated that it had been considering taking action against the complainant pursuant to the provisions of the Trespass to Property Act (TPA).

 

Documents from the College indicated that “it is the practice of the College to have recourse to the provisions of the [TPA] to bar from its premises persons whom the College Administration believes may pose a risk of serious harm to faculty members, staff and students of the College.”  We note that the College had initiated litigation in this form on two other occasions but in neither case did the College obtain a risk assessment on the individuals involved.

 

In the present case, the complainant’s threats were brought to the attention of a Vice-President of the College in December 1991.  Although the complainant left the College in November 1992, according to the College, staff and students were, nevertheless, in a state of apprehension about their personal safety.  In May 1993, the College telephoned the police to obtain information about the complainant but did not file a complaint. In June 1993, the College obtained the risk assessment and a notice under section 3 of the TPA was subsequently prepared and held on file by the College.  It was not until May 1995, almost two years after obtaining the risk assessment, that the College finally obtained a restraining order prohibiting the complainant from entry to all premises of the College. 

 

In our view, the information provided by the College indicates that it would not have been its practice nor would it have been necessary for the College to obtain a risk assessment in order to initiate litigation under the TPA where it was perceived that an individual posed a risk to College staff and students.  In this case, it would appear that the decision to prohibit the complainant from entry to the College, some two years after obtaining the risk assessment, was not dependent upon obtaining the risk assessment.

 

Therefore, while we accept that dealing with existing and contemplated litigation is a lawfully authorized activity, it is our view that the College's collection of the risk assessment was not "necessary" for the proper administration of this activity. 

 

Conclusion:    The College's collection of the complainant's personal information was not in compliance with section 38(2) of the Act.

Issue C:          Did the College provide proper notice of collection to the complainant, in compliance with sections 39(2) of the Act?     

 

 

Section 39(2) of the Act states:

 

Where personal information is collected on behalf of an institution, the head shall, unless notice is waived by the responsible minister, inform the individual to whom the information relates of,

 

(a)        the legal authority for the collection;

 

(b)        the principal purpose or purposes for which the personal information is intended to be used; and

 

(c)        the title, business address and business telephone number of a public official who can answer the individual's questions about the collection.

 

Section 39(3) of the Act states:

 

Subsection (2) does not apply where the head may refuse to disclose the personal information under 14(1) or (2) (law enforcement).

 

The College maintained that "its solicitation of an expert opinion amounted to a law enforcement activity so that the disclosure... would fall under Section 14(1) of the Act with the result that notice would not be required under section 39(2)."  Sections 14(1) and (2) of the Act fall under the access to information provisions of Part II of the Act.  These sections are applicable only in the context of a disclosure in response to an access request made under Part II.  Further, as previously stated, it is our view that the College did not collect the risk assessment for law enforcement purposes.  It is our view, therefore, that the College was required to give notice for its collection in compliance with section 39(2) of the Act.

 

The College also indicated that "in any case, in accordance with the provisions of section 39(2) of the Act", the College notified all students in the complainant's educational program that personal information would be collected throughout the program. The College's notice stated:

 

Pursuant to Section 39(2) of the Freedom of Information and Protection of Privacy Act , you are hereby notified that personal information relating to you is being collected for the principle [sic] purposes of Education Administration and Statistics.  The legal authority for this collection is the Ministry of Colleges and Universities Act, R.S.O. 1980, C. 272; R.R.O. Reg 640.  Questions about this collection should be directed to: ...

 

The notice also gave the name, title, address, and telephone number of the individual who could answer questions about the collection.

 

We are of the view that this notice, provided at the time the complainant was a student, was not sufficient for the purposes of collecting the risk assessment.  At the time the risk assessment was requested and collected, the complainant was no longer a student of the College.  He had ceased to be a student some months earlier.   It is our view that the above notice was intended for students during the time they were enrolled in the College and did not apply to former students.  In addition, the notice stipulated that the information was being collected for the “purposes of Education Administration and Statistics".  This, however, was not the purpose of the collection of the risk assessment-- the College’s stated dominant purpose for collecting the complainant’s personal information was to deal with existing and contemplated future litigation.

 

We are, therefore, of the view that since the complainant was no longer a student at the College and since the purpose of the College’s collection was not an educational one, the College did not provide the necessary notice under section 39(2) for collecting the risk assessment. 

 

 

Conclusion:    The College did not provide proper notice of its collection of the complainant's personal information in compliance with section 39(2) of the Act.

 

 

 

 

 

Issue D:          Did the College disclose the complainant's personal information contained in his letter to the nursing instructor in compliance with section 42 of the Act?

Section 42 of the Act sets out the circumstances under which an institution may disclose personal information.  This section states in part:

 

An institution shall not disclose personal information in its custody or under its control except,

...

(c)        for the purpose for which it was obtained or compiled or for a consistent purpose;

 

Section 43 of the Act further defines consistent purpose as follows:

 

Where personal information has been collected directly from the individual to whom the information relates, the purpose of a use or disclosure of that information is a consistent purpose under clauses 41(b) and 42(c) only if the individual might reasonably have expected such a use or disclosure.

 

The College took the view that the complainant's personal information in his letter had been disclosed in compliance with section 42(c), for a consistent purpose. The College stated that the letter in question had been obtained while the complainant was receiving educational services from the College.  It was the College's view that the complainant should have expected that the College would "act upon its legal and moral responsibility to provide for a safe learning and working environment in the light of the situation at that time" and that the complainant would have reasonably expected the College to take any steps necessary to respond to the escalating nature of his threats and legal activities.  The College's view, therefore, was that the complainant would have reasonably expected that his personal information would be disclosed to the Institute for the purpose of obtaining the risk assessment.

 

It is our view that the College would have collected the letter written in October 1992 by the complainant for the purpose of dealing with or replying to the issues raised by the complainant in his letter, including his belief that he was being harassed and discriminated against.  However, it is our view that the complainant could not have reasonably expected that his letter would then, in June 1993, be disclosed to the Institute for the purpose of obtaining a risk assessment about him.  It is our view that the College's disclosure of the letter was not for a consistent purpose in compliance with section 42(c).

 

We have examined the other provisions of section 42 of the Act and it is our view that none were applicable to the College's disclosure.

 

Conclusion:    The College did not disclose the complainant's personal information contained in his letter to the nursing instructor in compliance with section 42 of the Act.

 

- 10 -

Other Matters

 

During the course of this investigation, the following matter was identified which should be brought to the institution's attention.

 

The College's policy on "Persons Identified as Posing a Risk of Harm" includes procedures on obtaining an "expert opinion such as a medical assessment of a student's psychiatric or medical disorder".  It is our view that the collection of such sensitive information, without the knowledge of the student involved, is privacy invasive and could lead to infringements of the collection provisions of the Act.

 

SUMMARY OF CONCLUSIONS

 

•           The College’s letter to the Institute which included the complainant’s letter, and the risk assessment contained the complainant's "personal information", as defined in section 2(1) of the Act.

 

•           The College did not collect the complainant's personal information in compliance with section 38(2) of the Act.

 

•           The College did not provide proper notice of its collection of the complainant's personal information in compliance with section 39(2).

 

•           The College did not disclose the complainant's personal information contained in his letter to the nursing instructor in compliance with section 42 of the Act.

 

RECOMMENDATION

 

We recommend that the College take steps to ensure that personal information is not collected or disclosed except in compliance with the Act.  For example, the College should amend its policy for the collection of medical or psychiatric information to ensure that the collection of such information is in accordance with sections 38(2) and 39 of the Act.

 

Within six months of receiving this report, the College should provide the Office of the Information and Privacy Commissioner with proof of compliance with the above recommendation.

 

 

Original Signed by:                        December 6, 1995  

Susan Anthistle                                                                                   Date

Compliance Review Officer

***